Nigel Farage’s Reform UK announced this week they’d scrap GDPR entirely and replace it with a New Zealand-style privacy law. For European SMBs operating across borders, the real threat isn’t the politics—it’s what happens to the EU adequacy decision if the UK diverges too far.
Nigel Farage and Reform UK announced this week they’d scrap the UK GDPR entirely and replace it with a “light-touch” privacy law modeled on New Zealand’s framework. The pitch is familiar: small businesses have been “strangled” by EU red tape, and a looser regime will unlock growth. Politically, it’s a clean populist message. For European SMBs operating across borders—and that’s most of them—it’s a strategic minefield.
The Adequacy Decision Is Everything
Here’s the mechanism that actually matters. Data flowing from the EU to the UK today moves freely because of one thing: the EU adequacy decision. In December 2025, the European Commission renewed that decision for six years, extending it until 2031. Adequacy means EU businesses can transfer customer data, HR records, and operational databases to UK partners without extra legal scaffolding—no Standard Contractual Clauses, no transfer impact assessments, no friction.
That decision hinges on one finding: the UK’s data protection framework remains “essentially equivalent” to the GDPR. The European Data Protection Board (EDPB) monitors this continuously. And here’s the constraint: if the UK diverges “materially,” the adequacy decision can be withdrawn.
What Reform UK is proposing would test that constraint to its limits. A New Zealand-style privacy regime is not a subtle tweak to UK GDPR. New Zealand’s Privacy Act emphasizes business flexibility and does not carry the same granular consent requirements, automated decision-making protections, and cross-border transfer safeguards that the GDPR demands. If the UK moved in that direction, the EDPB would likely flag it as a material divergence. The Commission could then initiate a review—and potentially revoke adequacy within 12 to 18 months.
What That Means for Your Compliance Stack
Adequacy withdrawal is not a theoretical risk; it’s a cost multiplier. Imagine a 30-person SaaS company in Berlin that sells to customers across Europe and the UK. Today, they maintain one privacy policy, one GDPR audit cycle, and one data transfer framework. If adequacy collapses, they suddenly operate under two separate regimes.
For any customer data residing in the UK, they’d now need Standard Contractual Clauses (SCCs) plus a transfer impact assessment (TIA) for each transfer. That’s an extra legal review, documentation, and potential risk mitigation measures depending on what UK law does to your data in transit. For a mid-market company with hundreds of customer relationships, that’s not cosmetic—it’s €15,000 to €40,000 in additional legal work in year one alone.
Worse, you’re still uncertain what the new UK law actually says. Reform UK hasn’t published detailed legislation; they’ve announced an intent. You’d be holding your compliance posture in limbo for 18 months, waiting for Westminster to pass something, for the EDPB to assess it, and for the Commission to decide. During that window, you’re not allowed to assume adequacy is safe. Your legal team, your data processors (your cloud vendor, your HR platform, your CRM provider), and your compliance calendar all freeze in uncertainty.
The complication deepens for vendors. If you sell software to European SMBs and process their data in the UK, the adequacy withdrawal affects your whole customer base. You’d have to renegotiate data processing agreements, migrate infrastructure, or implement SCCs across hundreds of contracts. One vendor I work with supporting 200+ EU customers estimated this scenario would cost €80,000+ in rework, plus months of legal review and customer coordination. For a bootstrapped startup, that’s existential.
The Political vs. the Practical
Here’s where the thesis gets sharp: Reform UK says they want to preserve UK-EU adequacy. That’s the central tension in their proposal. They’re claiming you can have lighter regulation AND stay equivalent to the GDPR. That’s only true if “lighter” means “streamlined and more proportionate” and not “fundamentally different.” New Zealand’s model suggests the latter. If the EDPB sees it that way, the UK’s hand is forced—you can’t stay in the club if you stop following the rules.
Even if adequacy somehow survived, there’s a secondary risk: the EDPB has already flagged concerns about UK government access rules (Technical Capability Notices) and the restructuring of the ICO. Those scrutiny points are live. Add a radical privacy law on top, and the Commission’s monitoring becomes intensive. You’re operating in a framework under active suspicion.
What to Do Now
This is not a “wait and see” moment. SMBs that rely on UK data transfers should act in parallel:
- Audit your UK data residency: Map where customer and operational data lives. How much processing happens in the UK versus the EU? Could you migrate to EU infrastructure if forced?
- Review your vendors: If your cloud provider, HR platform, or CRM processes data in the UK, ask them now about their contingency plans. Do they have EU data centers? Can you reroute data if adequacy changes?
- Document your transfer logic: If adequacy falls, you’ll need SCCs. Prepare the legal groundwork now—transfer impact assessments, risk mapping, and appropriate safeguards. It’s cheaper to do this incrementally than in crisis mode.
- Track the EDPB’s monitoring cycle: The Commission is obligated to report on UK data protection developments. The next formal review is in 2029. Before then, watch for EDPB opinions and Commission press releases. The language of “divergence” or “material change” is your leading indicator.
For European SMBs already managing EU AI Act compliance, this is another axis of fragmentation. You’re now navigating GDPR + UK divergence + AI Act rules. Vendors are pulling in three directions. The honest read: prepare your compliance infrastructure to run dual frameworks, because even if Farage’s proposal dies in Westminster, the fact that it’s on the table signals that UK adequacy is now a live political risk, not a given.
0 Comments